hero123457/qtmqtt
1
0
Fork 0
mirror of https://github.com/qt/qtmqtt.git synced 2026-10-25 16:16:26 +00:00
Code Issues Projects Releases Wiki Activity

Fix topic alias bounds and storage sizes

Browse Source 
- In the f8ecf4d56a we found that the
m_receiveAliases bounds check used a wrong property:
m_clientPrivate->m_serverConnectionProperties.maximumTopicAlias(),
but it must use instead:
m_clientPrivate->m_connectionProperties.maximumTopicAlias().

So, the idea is m_receiveAliases is sized according to the maximum
topic alias value declared by the client in CONNECT, while
m_publishAliases is sized according to the maximum value declared
by the server in CONNACK.

The previous fix did not update all related code.
1) The resize() calls for m_receiveAliases and m_publishAliases
still used the wrong properties.
2) The bounds check for m_publishAliases still used the client's
maximumTopicAlias() value instead of the server's.

- Update the resize() calls to use the appropriate connection
properties and fix the bounds check for m_publishAliases.

Amends f8ecf4d56a

Pick-to: 6.11 6.12 6.8
Task-number: QTBUG-149564
Change-Id: I252c67966bf28c6994f34b19024d1b7894748473
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
This commit is contained in:
Tatiana Borisova 2026-08-20 13:24:37 +02:00
parent ee16836877
commit 011eb1e424
1 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/mqtt/qmqttconnection.cpp
View File

@ -472,7 +472,9 @@ qint32 QMqttConnection::sendControlPublish(const QMqttTopicName &topic,
const quint16 topicAlias = publishProperties.topicAlias();
if (topicAlias > 0) { // User specified topic Alias
if (topicAlias > m_clientPrivate->m_serverConnectionProperties.maximumTopicAlias()) {
// m_publishAliases is sized from the maximum the server declared in CONNACK,
// so bounds-check against the list itself rather than against a property value.
if (topicAlias > m_publishAliases.size()) {
qCDebug(lcMqttConnection) << "TopicAlias publish: overflow.";
return -1;
}
@ -1571,8 +1573,16 @@ void QMqttConnection::finalize_connack()
// property length. Do not overwrite the state of a connection which is gone.
if (m_internalState == BrokerDisconnected)
return;
m_receiveAliases.resize(m_clientPrivate->m_serverConnectionProperties.maximumTopicAlias());
m_publishAliases.resize(m_clientPrivate->m_connectionProperties.maximumTopicAlias());
// MQTT 5.0, 3.1.2.11.5 and 3.2.2.3.8: the two Topic Alias Maximum values are
// directional. The value this client sent in CONNECT bounds the aliases the
// server may use towards us (m_receiveAliases); the value the server sent in
// CONNACK bounds the aliases we may use towards it (m_publishAliases).
// Mappings live only for the lifetime of a network connection, so discard any
// left over from a previous one instead of resizing in place.
m_receiveAliases.clear();
m_receiveAliases.resize(m_clientPrivate->m_connectionProperties.maximumTopicAlias());
m_publishAliases.clear();
m_publishAliases.resize(m_clientPrivate->m_serverConnectionProperties.maximumTopicAlias());
// 3.2.2.2
switch (QMqtt::ReasonCode(connectResultValue)) {
@ -1756,7 +1766,9 @@ void QMqttConnection::finalize_publish()
if (publishProperties.availableProperties() & QMqttPublishProperties::TopicAlias) {
const quint16 topicAlias = publishProperties.topicAlias();
if (topicAlias == 0 || topicAlias > m_clientPrivate->m_connectionProperties.maximumTopicAlias()) {
// m_receiveAliases is sized from the maximum this client declared in CONNECT,
// so bounds-check against the list itself rather than against a property value.
if (topicAlias == 0 || topicAlias > m_receiveAliases.size()) {
qCDebug(lcMqttConnection) << "TopicAlias receive: overflow.";
closeConnection(QMqttClient::ProtocolViolation);
return;